Roles, Permissions & Agency Access
This is how you let a team or agency work on your ads without ever handing over your password — and without risking losing control of your own assets. Set it up correctly once and offboarding anyone is a two-click job.
By the end of this lesson you'll know
- The two access levels and what each can do
- Finance, temporary and integration access
- People vs Partners vs System Users
- The safe way to give an agency access
Two levels of access
Meta keeps it simple. Every person gets one of two levels — and this applies both to the portfolio as a whole and to each individual asset (Page, Instagram, ad account):
| Level | Formerly called | What they can do |
|---|---|---|
| Full control | Admin | Everything: settings, people, assets, billing — and can delete the portfolio. |
| Partial access | Employee / Basic | Work only on the specific assets and tasks you assign. The safe default. |
On top of these, you can add a few extras when needed:
- Finance access — view or manage billing, invoices, spend and payment methods.
- Apps & integrations (formerly “developer”) — set up the Conversions API and access tokens.
- Temporary access — basic access that auto-expires between 3 and 75 days. Perfect for a short project.
Portfolio permissions take priority. Someone can have full control of a single asset without any control of the portfolio. That's exactly how you give an agency power to run your ad account while they still can't add people, change settings, or touch anything else.
Three ways to grant access
- People — individuals (employees, freelancers) added by email. Their personal Facebook account gets the access; no password sharing.
- Partners — another business, like an agency. You grant (or they request) access to specific assets using a business ID. Crucially, they never own your assets — your portfolio does. They manage their own team on their side.
- System Users — non-human accounts for tools, apps and API integrations.
The safe way to onboard an agency
- Keep your assets in your portfolio (you set this up in Lesson 2.1).
- Add the agency as a Partner and grant access only to the specific assets they need — usually the ad account and Page.
- Give finance access only if they're managing your billing.
- When the engagement ends, remove the partner — instantly cutting all their access while everything stays yours.
Give the minimum access someone needs to do their job, keep full-control users to a trusted few, and review the People and Partners lists every few months. Remove anyone who no longer needs access.
Never share your personal Facebook login, and never give an agency full control of your portfolio. Asset-level partner access is all they need. Handing over the portfolio is how businesses get locked out of their own ad accounts and Pixels.
Key takeaways
- Two levels: full control (admin) and partial access (employee) — plus finance, integration and temporary add-ons.
- Portfolio permissions take priority over asset permissions.
- Grant access via People, Partners or System Users — agencies come in as Partners.
- Give agencies asset-level access only; never the portfolio, never your password.